CVE-2024-31867
published 2024-04-09CVE-2024-31867: Improper Input Validation vulnerability in Apache Zeppelin. The attackers can execute malicious queries by setting improper configuration properties to LDAP…
PriorityP336medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
1.18%
66.4th percentile
Improper Input Validation vulnerability in Apache Zeppelin.
The attackers can execute malicious queries by setting improper configuration properties to LDAP search filter.
This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.
Users are recommended to upgrade to version 0.11.1, which fixes the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | zeppelin | >= 0.11.1 < 0.12.1 | 0.12.1 |
| apache | zeppelin | >= 0.8.2 < 0.11.1 | 0.11.1 |
| apache_software_foundation | apache_zeppelin | >= 0.11.1 < 0.12.1 | 0.12.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
LDAP filter injection vulnerability in Apache Zeppelin.
ghsa_unreviewed·2026-07-30·CVSS 6.5
CVE-2026-44617 [MEDIUM] CWE-90 LDAP filter injection vulnerability in Apache Zeppelin.
LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped. This is an incomplete fix of CVE-2024-31867. This issue affects Apache Zeppelin versions 0.11.1, 0.11.2, and 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.
GHSA
Apache Zeppelin: LDAP search filter query Injection Vulnerability
ghsa·2024-04-09
CVE-2024-31867 [MEDIUM] CWE-20 Apache Zeppelin: LDAP search filter query Injection Vulnerability
Apache Zeppelin: LDAP search filter query Injection Vulnerability
Improper Input Validation vulnerability in Apache Zeppelin.
The attackers can execute malicious queries by setting improper configuration properties to LDAP search filter.
This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.
Users are recommended to upgrade to version 0.11.1, which fixes the issue.
OSV
Apache Zeppelin: LDAP search filter query Injection Vulnerability
osv·2024-04-09
CVE-2024-31867 [MEDIUM] Apache Zeppelin: LDAP search filter query Injection Vulnerability
Apache Zeppelin: LDAP search filter query Injection Vulnerability
Improper Input Validation vulnerability in Apache Zeppelin.
The attackers can execute malicious queries by setting improper configuration properties to LDAP search filter.
This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.
Users are recommended to upgrade to version 0.11.1, which fixes the issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2024/04/09/12https://github.com/apache/zeppelin/pull/4714https://lists.apache.org/thread/s4scw8bxdhrjs0kg0lhb68xqd8y9lrtfhttp://www.openwall.com/lists/oss-security/2024/04/09/12https://github.com/apache/zeppelin/pull/4714https://lists.apache.org/thread/s4scw8bxdhrjs0kg0lhb68xqd8y9lrtf
2024-04-09
Published